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James W. Mar 
P.O. Box 512S1 
Pacific Grove, CA 993950 


12 December 1993 


Dr. John M. Deutch 

Under Secretary of Defense for Acquisitions 
3010 Defense Pentagon 
Room 3E933 Pentagon 
Washington D.C. 20301-3010 


Dear Dr. Deutch, 


Attached are the Findings and Conclusions and the j 
Recommendations of the C-17 Executive Independent Review Team. 
Additionally, there are Appendices that provide definitions ahd 


background information. 


Sincerely yours. 
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FINDINGS & CONCLUSIONS 

0. The EIRT received excellent and exemplary support from both the SPO and 

McDonnell Douglas Aerospace engineers. Their competence, enthusiasm and 
dedication were very evident during our discussions. We greatly appreciate 
their patience in answering our questions. In order to meet the very 
demanding U5AF requirements, Douglas has had to use the best of current 
engineering philosophy, processes and analytical methodologies. Compared 
to other transport category aircraft, the C-17 wing structure is efficiently 
designed and the EIRT believes Douglas engineering deserves praise for their 
accomplishment. 

1. The static test of the C-17 wing during the loading condition designated as SP 

5005M (maximum wing up-bending) was terminated by a failure located in 
bay 26 of the upper surface of the left hand wing at 144% of test limit load or. 
Seprember 10, 1993. Damage to the left hand wing was extensive but most of 
this was secondary and can be attributed to the paroxysm of the loading jacks 
after the initial failure. 

♦ 

2. Test SP5005M verified the strength of bay 26 to its specification level of 150% o 

design limit load even though the test did not reach its goal of 150% of test 
limit load. Due to the manner in which the test loads simulate the design 
limit loads, 150% of design limit imposes the same stresses as does 144% of 
test limit in bay 26 because the test loads do not account for the relieving 
effect of the chordwise bending caused by the winglet. 

3. The EIRT believes the entire upper surface of the wing has been qualified 
through a judicious combination of tests and analyses. 79% of the upper 
surface of the wing has been fully qualified by tests to 150% of test limit or 
design limit by SP5030M and SP50Q5M even though SF5005M did not reach is 
objective of 150% of test limit load. Of the remaining 21% of the upper 
surface, some portion is within one per cent of the stresses sufficient for 
qualification, another portion is within two percent and the largest 
insufficiency is 4%. The engineering methodology to predict that a failure will 
not occur has been verified by the more than 600 separate beam-column 
structural components throughout the wing that did not fail under the 
loadings imposed by test SP5030M which attained 150% of test limit and by 
test SP5005M which attained 144%. Consequently, the EIRT believes it is 
appropriate to use analysis for the extrapolation of the experimental data 
from 144% to 150%. Therefore analysis is the means whereby the remaining 
21% of the upper surface is qualified. Historically, this is the approach that has 
been used. 

4. The findings cited in (2) & (3) support the EIRT conclusion that a rerun of 

condition SP5005M to 150% will not yield significant additional information 
on the strength of the wing, 
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5. One of the abnormal conditions which increases the design bending moments 

on the wing is the so-called fuel imbalance that accounts for a potential 
system failure in the fuel system. This fuel imbalance is set at 8000 pounds for 
the C-17. (It was learned that the fuel unbalance for the MD-11 freighter is 
2500 pounds.) A reduction in the design bending moments accrues for the 
wing If the fuel imbalance can be reduced to 3000 pounds. Analyses and tests 
on other aircraft have demonstrated that this is readily achievable. The flight 
tests revealed an additional reduction in bending moment due to aileron 
effect! vity and the fact that the flight control system is set so that the ailerons 
are not symmetrically deployed to counter the imbalance. Both of these 
changes in the specifications would result in tests SP5030M and SP5005M 
having qualified 95% of the upper cover of the wing. 

6. The failure at 144% of limit condition SP 5005M was initiated by the crippling 

of the front spar cap inboard flange in bay 26 of the left hand wing. The cause* 
of the premature failure are as follows: 

a. The spar web in bay 26 had been weakened by the prior tests of the 

wing. This weakened web induced additional loads that over- 
stressed the spar cap. Strain gage response reveals that prior tests 
had caused irreversible damage to the shear carrying capability of 
the web . 

b. The flange of the spar cap was undersized due to a machining error. 

This means the strength of the flange, l.e., the crippling allowable, 
is reduced below the value used in the design. 

The right hand wing did not exhibit any of these same symptoms. The EIRT 
concludes this failure is peculiar to bay 26 of the left hand wing of the static 
test article; there are no implications for any other regions of the wing and 
hence modifications to the wing are not required. 

7. The EIRT endorses the so-called productionized wing and believes the use of 

larger aluminum extrusions is fundamentally superior to the use of steel 
doublers. The EIRT accepts the structural qualification by analysis of the 
larger extrusions. In this regard, the steel doubler reinforced members have 
been qualified by tests SP5030M and SP5005M. This gives assurance that 
analysis can be used because the structural parameters of the larger extrusions 
are within those of the steel reinforced z-stringers. From a fatigue standpoint, 
the use of the extrusions is inherently better because the thousands of 
fasteners used in the steel doubler members have been eliminated. 
Additionally, the upper surface of the wing has ample margin to meet the 
durability requirements and the effect on the lower surface is beneficial but 
rather insignificant. 

8. The EIRT endorses, in principle, the steps being taken to modify the static test 

article so that the remaining static tests can be accomplished. In order to apply 
the loads to the right wing, a large part of the left wing has been removed. 
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The remaining stub of the left wing is being reinforced and modified to apply 
the loads necessary to balance the test loads on the right wing. 

9. There are a number of major tests to be accomplished before the airframe of 

the C*17 is fully qualified. The requirement Is that all of these tests be carried 
to test ultimate. The portions of the airframe to be exercised in the remaining 
tests include down bending of the wing, bending of the fuselage, fuselage 
frames, the fuselage pressure shell and the pylons. It should be noted that 
there are locations where the calculated margins of safety are below 5% and 
hence the possibility of a failure is not remote. In this regard the EQtT is of tr.s 
opinion that three of these requirements are unrealistically too severe. The 
dynamic taxi condition, T093W1, places all of the 159200 pounds of load as 
fuel in the wing with zero payload. This of course will maximize the stresses 
in the wing during high spWd taxi. There is a fuselage jacking condition 
wherein there is maximum fuel in the wing while the airplane is completely 
supported on jacks. This is a back-breaker requirement for the fuselage. 

Finally the so-called 2P condition requires the testing of the fuselage to the 
maximum design pressure of 16.6 psl. Each airplane fuselage will be tested, 
prior to delivery, to the proof pressure of 11 psl which is much larger than thi 
normal maximum cabin pressure of 7.8 psi. This proof pressure test fulfills 
the specification requirement for qualification of the fuselage structure. 

10. The planned sequence of the 017 wing static test program carried each 
condition to ultimate before proceeding to the next condition. In retrospect, :: 
was not the sequence to maximize the amount of data acquired with the 
minimum amount of disruption to the program. A better sequence would 
have been to carry each condition to limit and then to carry only one 
composite condition to ultimate. The design deficiency revealed by the test 
failure of October 1, 1992 would still have been found and neither the 
schedule disruption caused by the October 1, 1992 failure nor the test failure c: 
September 10, 1993 would have occurred had this latter sequence been in 
effect. It is even within reason to speculate that the strain gage data from all o; 
the tests to limit load may have revealed the design deficiency, permitting the 
design changes to be incorporated prior, to the conduct of the ultimate test 
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RECOMMENDATIONS 

1. The EIRT recommends that each of the remaining full scale static test 
conditions that involve the icing and fuselage be carried just to test limit 
load before any condition is carried to test ultimate. The likelihood of an 
unexpected failure increases as the load increases above test limit. As has been 
demonstrated, a failure can inflict serious damage to the wing and/or 
fuselage, causing at best, a major delay in the schedule or, at worst, the 
complete loss of the static test article. Such a sequence of completing firstly all 
of tne conditions to test limit will insure that there will be, at the least data 
on the limit load response from all of the structure to be qualified by the 
remaining tests. 

2. The EIRT, if asked, would approve a reduction in the number of tests 

remaining to be carried to test ultimate conditions. This test article has 
experienced the trauma of two failures, the wing has been loaded six times 
above limit conditions, seven other times to limit conditions and the left 
wing now suffers the ignominy of being part of the*test fixture. The EIRT 
recommends the C-17 Program Office determine which of the presently 
planned ultimate tests will reveal understanding of the structural behavior 
not already confirmed by tests to limit and prior tests to ultimate . In this 
regard, for example, the beam-column methodology has been validated by the 
previous upbending tests. The EIRT believes a reduction in the number of 
ultimate tests can be justified, and there will be concomitant cost and 
schedule benefits. 

3. The EIRT believes that two of the remaining test conditions are unrealistically 

overly conservative. These are as follows: 

a. The dynamic taxi condition, T093W1, to meet the airplane gross 

weight of 434,500 pounds puts 159,200 pounds of fuel In the wing 
and no payload in the fuselage. This distribution of the 159,200 
pounds does maximize the downbending of the wing but it appears 
to the EIRT wholly unrepresentative of actual operations. 

b. The fuselage jacking condition, JK216M, has the wing completely 
full of fuel with the airplane completely supported on jacks. This 
ground condition maximizes the downbending of the fuselage 
appreciably beyond any flight condition. It does not seem 
reasonable to the EIRT to jack up the airplane with the wings full 
of fuel. For example, wheel changes can be accomplished without 
this kind of jacking. 

Although the structure has been designed to meet these extreme dynamic taxi 
and jacking conditions, the EIRT recommends that the severity of these 
requirements be challenged on the bases of need and rationality. If relief will 
be granted, the EIRT recommends the test loadings be lowered accordingly. 
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4. The ultimate design pressure condition, 2p, requires the pressurization of the 

fuselage to 16.6 psi. Every production fuselage will be proof pressure tested in 
the factory to 11 psi which is larger than the normal operating pressure of 7.8 
psi. The EIRT believes the proof pressure test obviates the need for the 2p test 
It should be noted that a fuselage pressurized to 16.6 psi has sufficient stored 
energy to wreak much damage to the surroundings should a failure occur. 
Such a test to ultimate design pressure is not required of dvil transport 
category aircraft. The EIRT recommends that the 2p condition be eliminated 
from the full scale static test program. 

5. The EIRT recommends that steps be taken to reduct the allowable fuel 
unbalance from 8000 pounds to 3000 pounds. There are issues regarding the 
C-17 fuel measuring system that need to be resolved, but these appear to be 
surmountable. Reductions in loads should always be pursued especially if, as 
is the case for the fuel imbalance, there are no operational implications. 

6. The EIRT recommend$ that the Program Office continue to challenge the Air 
Mobility Command on the magnitude of the payload asymmetry. The EIRT 
recognizes the load master loses some flexibility in -the placement of the 
payload if the payload asymmetry is reduced. A few tests have been conducted 
at Fort Hood that give promise of a reduction in the payload asymmetry that 
is acceptable to the load master. 

r 

* 

7. The EIRT was surprised to learn that the C-17 does not have a load alleviation 

system. For example, such a system was incorporated into the C5-A, A load 
alleviation system in the 07 would have appreciably reduced structural 
weight that could have been used to increase range and/or payload. There is 
an understandable aversion to re-writing the flight control software necessary 
to achieve load alleviation. As already stated, reductions in loads should 
always be pursued, even for the C-17 airplane which is meeting all of its 
structural integrity requirements. A load alleviation system will make it 
easier to meet future changes in operational usage. The EIRT recommends 
that a load alleviation system be developed for the C-17. 

8. In retrospect the USAF requirement to test the C-17 static article to ultimate 

conditions several times was ill-devised. To meet the ultimate conditions, an 
efficient structure will be operating in a regime where both material and 
geometric non-linearities are important. This means the imposition of an 
ultimate condition will cause some permanent damage even if there has been 
no obvious failure. Thus, the next test condition is imposed not on the 
pristine structure upon which the original design analyses were carried out 
but upon a slightly damaged structure. The EIRT recommends the USAF re- 
examine the ultimate test requirements to determine if it is still sensible . 
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APPENDIX C DEFINITIONS & NOMENCLATURE 

Limit loads are the maximum loads that the aircraft is expected to actually 
experience during its life. The structure shall exhibit no detrimental 
permanent deformations after the application of limit loads. 

Ultimate loads are limit loads multiplied by the factor of safety which is specified 
to be 1.5. The structure shall support without failure the ultimate loads. 

(Note: Ultimate loads are fictitious because the aeroelastic characteristics of 
the airplane makes it physcially impossible to develop these ultimate loads 
flight. This is in contradistinction to the limit loads which can be developed 
by the airplane .) 

'* Design limit loads axe the loads used for the design of the C-17. 

Test limit loads are the loads applied to the static test article that simulate the 
design limit loads. The simulation is not exact because of the limitations of 
the test fixtures. 

Test ultimate loads are test limit loads multiplied by the factor of safety of 1.5. 


Allowable - Requirement 

Margin of Safety a — — — ■ — 

Requirement 

where the allowable is the capability of the structure and the 
requirement is what is imposed on the structure by a design 
condition. For example, the allowable for a member in tension 
made of the aluminum alloy, 7150, is the tensile ultimate of 85 
ksi. If the stress induced by a particular ultimate loading 
condition is 80 ksi, then the Margin of Safety, M.S., is 

85 - 80 

M.S. s ■■ — a .063 or 6.3% 

80 


For a structure subjected to multiaxial loadings, such as is the case 
for the upper surface of the C-17 wing, the determination of the 
margin of safety becomes much more involved than is shown 
by this example. 
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SP5005M : The designation for the loading condition that terminated at 144% o: 
test limit load. SP refers to steady pitch (the aircraft Is subjected to a pilot 
induced maneuver) and the M means modified to the 585,000 pound TOGW. 

DG5001: The designation for the loading condition that caused the wing failure 
on October 1, 1992. DG refers to discrete gust (the airplane encounters a gust) 
and the M means modified to the 585,000 pound TOGW. 


APPENDIX D THE WING STRUCTURE 

The wing in the region of the failure is comprised of two spars consisting 
of spar caps which are mechanically fastened to the spar webs. The upper and 
lower surfaces of the wing consists of z shaped stiffeners mechanically fastened 
the wing skins. Wing up-bending causes the upper surface to be in compression 
which means that structural instability is the dominant mode of failure. Each z 
stiffener plus a width of the skin is modeled as a structural entity called & beam- 
column that is subjected to compression, local bending and shear along the edges 
of the width of skin. The compression load is caused by up-bending (transverse 
bending) of the wing; the local bending is due to the combination of airload 
pressure, crushing pressure induced by wing up-bending, fuel pressure and 
column compression combined by a beam-column analysis; and the shear is 
caused by the torsion which accompanies up-bending of the wing. The spar caps 
plus a width of skin are modeled as structural entities subjected to compression, 
local bending and shear along the edges of the width of skin. However, column 
buckling is not critical because the skin prevents column buckling in one 
direction and the shear web prevents buckling in the perpendicular direction. 
The length of each beam-column i$ the distance between wing ribs. 

Column buckling determines the allowable for compression, crippling 
determines the allowable for local bending and the material shear stress is the 
allowable for the shear. Implicit in the modeling of the upper surface of the wir.s 
as a collection of beam-columns is that crippling of each of the components of 
the z stiffeners or spar caps will not occur at the loads used in the analyses of the 
beam-columns, i.e., the crippling allowable of each component is above the beam 
column allowable. 

The ability of each beam-column to carry a given load Is measured by a 
factor called the margin of safety, M.S. A zero margin of safety implies that the 
structure is perfectly designed and does not have any excess weight There are 
three components in the calculation of the M.S. for the beam-column, one 
weighing the effect of column buckling; one weighing the effect of the local 
bending and one weighing the effect of shear. These three components are 
combined in an empirical interaction formula that was slightly modified by 
Douglas after the first static test failure. 

The wing of the C-17 is very efficiently designed. This is evident when the 
weight of the wing is compared to other airplanes. In the region of the failure. 
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zero margins of safety are shown for the front spar and for the adjacent two 
stiffeners. 


APPENDIX E STRUCTURAL INTEGRITY 

The static test failure of 1 October 1992 and the recent failure of 10 September 
1993 has raised concerns about the structural integrity of the C-17. It is important 
to realize that the two tests that caused failure represent only a small part of the 
total structural integrity program. 

A brief review of the major elements in the structural integrity program is 
herein presented as the background for the findings, conclusions and 
recommendations made in the main body of this report 

The aircraft structure must possess three main attributes: 

1. Strength to sustain flight, landing and taxi loads. 

2. Rigidity to prevent detrimental aeroelastic effects such as 

flutter and aileron reversal. 

3. Longevity to sustain the cyclic application of flight, landing 

and taxi loads for a specified number of flight hours, landings 
and calendar years. ' 

At a particular region of the airframe, the physical sizes, e.g., thickness of the 
skin or the spacing of the stiffeners, may be dictated by any one of the three 
desired attributes. In the C-17, the lower surface of the wing is sized primarily bv 
longevity and the upper surface primarily by strength to resist buckling. Rigidity 
considerations are a factor in determining the spanwise location of the engines 
on the wing. 

In metal airplanes the repeated application of flight, landing and taxi loads 
will lead to the initiation of cracks that, if unrepaired, will grow to a size such 
that the damage tolerance strength requirements will be compromised. The 
detection of cracks and their repair can be a major maintenance burden. Thus, of 
the three attributes, longevity is the one that has the greatest impact on operating 
costs because continual surveillance is required for the detection of cracks. 

There are two facets to the strength attribute. The first is the capability to 
sustain design limit loads without permanent deformations, i.e., the structure 
must be reusable after experiencing design limit loads. The second is to sustain 
design ultimate loads without failure but the structure is not required to be 
reusable after experiencing design ultimate loads and indeed there is no 
requirement to be reusable after experiencing loads greater than design limits 
loads. Design limit loads are the maximum of those which the airplane is 
expected to experience during its life. In contrast, the design ultimate loads, 
which are legislated to be numerically equal to the factor of safety times the 
design limit loads, are fictitious in the sense that the airplane cannot be flown so 
as to develop design ultimate loads. The factor of safety is 1.5. It is impossible to 
satisfy the ultimate requirement without first satisfying the limit requirement so 
that from this viewpoint, the limit condition is the more important of the two. 
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The design ultimate requirement is intended to take care of unk-unks, 
unknown-unknowns. One can argue that the range of unk-unks for the C-17, the 
fifth generation of military transport category aircraft, is much less than for the 
DC-3. Nonetheless, airplanes designed to the factor of safety of 1.5 have been 
successful in meeting their strength requirements. 

There are three full scale airframes devoted to the verification of the design 
analyses: 

One is a flight test airplane used to verify the aerodynamic loads. This fligh: 
test airplane is also used to demonstrate that flutter and other aeroelasdc 
phenomena are beyond the normal flight 
envelop of the airplane, i.e., to validate the rigidity attributes. 

A second airframe is used to verify the longevity attributes by the cyclic 
application of the loads to be experienced in flight. This test is referred to 
as the durability test (also known as the fatigue test) by the USAP and its 
objective is to validate the crack initiation and crack growth 
characteristics of the airframe. The C-17 durability airframe wUFeydlc 
loaded to die equivalent of two lifetimes of usage; presently the 
durability airframe is at the equivalent of one-half of a lifetime. There 
are some who would like to see the application- of a third lifetime on the 
durability airframe because recent concerns about aging aircraft, military 
and dvil, are best addressed by a third lifetime of durability testing. 

The third airframe is used to verify the strength attributes of the C-17. To 
date 24 separate tests* have been completed on. the static test article and 6 
more remain to be completed. 
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The stresses used for the static strength design of the airframe are much larger 
than those used for the longevity, i.e., durability, design. This is shown in the 
accompanying traces of strain response from the durability test article, one from 
the upper surface and one from the lower surface. Both of these traces are taken 
from the worst case flight in the durability spectrum pf loading. 
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STRESSES IN UPPER SURFACE IN BAY 26 

In the upper surface the maximum compressive stress is seen to be 
approximately 20 k$i in the durability article whereas it reached a shade under 34 
ksi in the SP3005M test. 
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The structural design of the wing utilizes aerodynamic loads caused by a 
continuous distribution of pressures on the surfaces of the wing. The 
aerodynamic loading together with the inertia loads caused by acceleration causes 
a transverse bending (up-bending) moment, a chordwise bending moment, a 
torsional moment, a transverse shear and a chordwise shear at each cross section 
of the wing. The chordwise bending moment and chrodwise shear are caused by 
the drag on the wing and loads on the winglet. These moments and shears are 
used to determine the sizes of the stiffeners, spar caps and skins. It is important 
to remember that all five structural effects, (i) transverse bending, (ii) chordwise 
bending, (iii) torsion, (iv) transverse shear and (v) chordwise shear are included 
in the design analyses and that the calculation of these effects are based on a 
continuous distribution of loads. 
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The test loads that simulate the design loads are applied to the static test 
article through tension pads bonded onto the upper surface of the wing. Attached 
to these tension pads are mechanical linkages that are attached by a whiffle-tree 
assemblage to a system of hydraulic jacks. This loading system does not simulate 
the effects of chordwise bending nor chordwise shear because it is not practical to 
place another whiffle tree system onto the wing due to the large deflections 
experienced by the wing under load. In particular, the chord wisebending: caused 
by the winglet loads are neglected. These chordwise effects which are included ir. 
the design of the wing are generally an order of magnitude smaller than thwas 
overlaoded re knowingly omitted from the static test. 

Thus, at a given location in the wing, the margin of safety at 150% of design 
limit load will not be exactly the same as the margin of safety at 150% of test limi: 
load because the test loads do not exactly duplicate the design loads. For example, 
the following table compares design ana test margins of safety in bay ,26 fd&the 
spar cap and three adjacent stiffemers: ' ' ' 


1 1 

Front Spar Cap 34 

0 


12 

stringers 




Front 
Spar Cap 

Stringer 

34 

Stringer 

12 

Stringer 

11 

Margins of Safety 
at 150% of 
Design Limit Load 

0.04 

0 

0 

0.10 

Margins of Safety 
at 150% of 
Test Limit Load 

0 

0 

0 

0.02 


These are the margins of safety, calculated prior to the conduct of the test, 
for condition SP5005M that caused the failure. The zero margin of safety shown 
for the front spar cap indicates that the front spar cap is loaded more severly by 
the test than it should have been. In other words, the test loads cause larger 
stresses in the spar cap than were used for the sizing of the spar cap. 
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